A required certificate is not within its validity period

Mark.Foltarz · November 10, 2020, 2:14pm

I am stumped here. I am receiving an odd error unlike any previous certificate related errors I have seen. And I have not found anything relevant on to OPCUA on Google.

"Opc.Ua.ServiceResultException: Certificate has is expired or not yet valid. NotTimeValid: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file."

Several months ago I had to stop work on this project. And when I came back to a couple of days ago the application can no longer connect to the Ignition server in Visual Studio.

There are no quarantined certificates. in Ignition server to approve.

<11/10/2020 8:55:09 AM> System.AggregateException: One or more errors occurred. —> Opc.Ua.ServiceResultException: Certificate has is expired or not yet valid. NotTimeValid: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.
—> Opc.Ua.ServiceResultException: Certificate has is expired or not yet valid. NotTimeValid: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

at Opc.Ua.CertificateValidator.d__22.MoveNext()
— End of inner exception stack trace —
at Opc.Ua.CertificateValidator.Validate(X509Certificate2Collection chain)
at Opc.Ua.CertificateValidator.Validate(X509Certificate2 certificate)
at Opc.Ua.Configuration.ApplicationInstance.d__53.MoveNext()
— End of stack trace from previous location where exception was thrown —
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at System.Runtime.CompilerServices.TaskAwaiter1.GetResult() at Opc.Ua.Configuration.ApplicationInstance.<CheckApplicationInstanceCertificate>d__51.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at System.Runtime.CompilerServices.TaskAwaiter1.GetResult()
at CommMgr.Classes.OPCUAComm.d__18.MoveNext() in D:\Zeppelin\Projects\Repos\CommMgr for PLC Tags\CommMgr\Classes\OPCUA.cs:line 93
— End of inner exception stack trace —
at System.Threading.Tasks.Task.ThrowIfExceptional(Boolean includeTaskCanceledExceptions)
at System.Threading.Tasks.Task1.GetResultCore(Boolean waitCompletionNotification) at System.Threading.Tasks.Task1.get_Result()
at CommMgr.CommMgr.OPCThreadFunction() in D:\Zeppelin\Projects\Repos\CommMgr for PLC Tags\CommMgr\CommMgr.cs:line 280
—> (Inner Exception #0) Opc.Ua.ServiceResultException: Certificate has is expired or not yet valid. NotTimeValid: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.
—> Opc.Ua.ServiceResultException: Certificate has is expired or not yet valid. NotTimeValid: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

Kevin.Herron · November 10, 2020, 2:24pm

This implies that Ignition’s OPC UA server certificate has expired.

What version of Ignition are you using? Somewhere in the gateway web UI you should be able to view or download the server certificate to verify.

edit: an alternative explanation would be that your client’s certificate has expired, not really sure what the .NET (?) stack is doing here.

Mark.Foltarz · November 10, 2020, 2:53pm

Version: 8.0.4 (b2019091612)
The .Net portion is from the application log.

I did find an outdated client certificate and deleted it

The application is still throwing the error.
Does the server need to restarted to recognize the change ?

But these are the certs that are in there now :

Kevin.Herron · November 10, 2020, 2:55pm

It doesn’t look like there’s anything wrong on the server side. Your server certificate is not expired, so unless the date on your system is very wrong, you’ll probably have to start looking at your own client code. Given that you deleted an expired client certificate it seems possible that certificate belongs/belonged to your client implementation.

When your client does eventually connect its certificate will end up in the quarantine section on the “Server” tab and you’ll have to accept it.

Mark.Foltarz · November 10, 2020, 6:38pm

Forgive the newby question , but can you tell me where the client certificate would be on my side?